Comment by altairprime

The discount Google is getting on bounties versus internal spend is easy to estimate:

  # assumed to be $0.5mil USD or greater
  A := What quantity of salaries-and-benefits and AI-dollars does Google spend on zero-day research?

  # assumed to be greater than zero
  B := How many full sandbox RCEs are they *hoping* to discover per year with that budget?

  # $/RCE budgeted spend
  C := A ÷ B

  # $/bounty
  D := $1000 USD

  # % discount per bounty relative to in-house spend
  E := (C - D) / C

While we lack the data to be sure, it is reasonable to estimate that they're getting a discount of 90% or better versus internal spend on this bounty payment, if one assumes that they do not have many sandbox RCEs left undiscovered. It's unclear whether that assumption holds, but with only a single researcher at an assumed $0.5mil/year (all-inclusive after pay, stock, and benefits) is enough to support the plausibility of that 90% figure, before accounting at market rates for their internal use of the house AIs.

So, the most likely case is that they're greedy and miserly, and hope we don't do the math. However I recognize that there are judgment calls to be made here. Either their internal spending finds hundreds of RCEs per year, or they're significantly discounting bounty payments versus their actual worth, or they're negligent in budgeting for RCE discovery at all, or they assign zero value to the security of the Chromium platform underpinning Edge, Electron, et al. All of these are bad in different ways; one hopes a competent tech reporter actually pursues this line of questioning with them!